nuance-gulp-build-common OS Command Injection Vulnerability

nuance-gulp-build-common is a package for npm. nuance-gulp-build-common suffers from an operating system command injection vulnerability that stems from vulnerability to command injection via the index.js file...

Command Injection

async-git is vulnerable to command injection. An attacker is able to inject malicious OS command to the system shell via the getter function in the index.js file...

CVE-2020-7785

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

CVE-2020-7785 Command Injection

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

Malicious Package

jquerry is a malicious package. The index.js file downloads and executes a crypto mining script. However, the script is not executed upon installation...

Command Injection

async-git is vulnerable to command injection. An attacker is able to inject malicious OS command to the system shell via the getter function in the index.js file...

Command Injection

Overview xopen is a package that provides a dead-simple Promise API for opening files from Node on Windows, macOS, and Linux. Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 14 in index.js in the exported function xopenfilepath PoC: va...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 13 in index.js file in export.latestVersion function. PoC: var root = require"npm-help"; var module = "& touch JHU"; root.latestVersionmodule; Remediation There is no fixed versi...

Command injection in buns

There is a command injection vulnerability in all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function installrequestedModule...

Design/Logic Flaw

This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function installrequestedModule...

CVE-2020-7794

CVE-2020-7794 affects all versions of the buns package. The injection point is in lib/index.js:678 inside the exported function install(requestedModule). This enables command injection via crafted input; PoC and advisory details indicate insecure use of exec leading to arbitrary code execution. T...

CVE-2020-7794 Command Injection

This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function installrequestedModule...

Command Injection

ffmpeg-sdk is vulnerable to command injection. The vulnerability exists through the execute function in index.js, allowing an attacker to inject the code execution commands via remotely...

Command injection in connection-tester

This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. Affected versions of this package are vulnerable to Command Injection...

GHSA-W5MP-8P8W-MHH8 Command injection in connection-tester

This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. Affected versions of this package are vulnerable to Command Injection...

CVE-2020-7781

This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrates the vulnerability:...

CVE-2020-7781

This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrates the vulnerability:...

CVE-2020-7781 Command Injection

This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrates the vulnerability:...

CVE-2020-28439

This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:...

Command Injection

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Command Injection via the index.js file. PoC: var a =require"wc-cmd"; a"touch JHU" Note: CVE-2020-28431 has been retracted because it was found to be invalid. Remediation There is no fixed...